Hacker News Reader

PBKDF2 uses HMAC. What's the issue here? A PRF seems the right tool for this particular problem, and HMAC happens to be a PRF that has well understood properties.

View on HN

PBKDF2 uses HMAC the same way that multiplication uses addition.

So your objection here actually has nothing to do with HMAC at all, but with doing password hashing without iterations?

My complaint is about using a fast PRF where they should be using a slow PRF, yes.

Reply on news.ycombinator.com